I am trying to find out operational details of connecting a card reader module to an access gateway. Cisco documentation does not elaborate. Can the module operate in a stand alone mode if the CAN is disrupted? What are the on board capabilities of the modules? Where does Cisco recommend using modules instead of gateways?
The 'brains' of the solution are in the Gateway module. If it looses network connectivity to the CPAM server, it will still be capable of granting access to valid cards based on the last download of credential data from the CPAM server. It can still operate door lock and unlock schedules without a server connection. If the CAN bus fails between a Gateway and a Reader module, then the door controlled by the Reader module would not operate for access decisions. The decisions are made by Gateway or the CPAM server, so if the expansion modules (Reader, Input, and Output modules) loose connection to the Gateway, they would become inoperable.
Most deployments use 1 Gateway for 1 door.
Hope this helps,
Mike has answered the operation logic question.
The most common use for the card reader module is on a retrofit of an existing access control install. In this kind of deployment if you have more than a couple access controlled doors located within the distance constraints of the CAN bus you can take over the existing door hardware (reader, sensor, REX, lock), which will already have power installed that can power the card reader module. So in theory you could get away with just installing 1 Access Gateway in a specific area and leverage card reader modules for the other doors.
I agree with all of the above, but note that best practice is one gateway per door. You could get away with two doors per gateway if you weren't powering with PoE (power budget usually can't support it). In all of our implementations where we retro fit legacy systems we use one gateway per door. In my experience, using reader, input, and output modules work best in specialty configurations. For example, in a large warehouse you didn't want to install a network closet just for one cable run, you could run the CAN bus out to a reader module instead.